v1.4.0

Highlights

• Enforcement hooks. The plugin now blocks likely credential values in workflows, reports, and PR text; blocks deleting files outside .github/ci-archive/; checks workflow quality; and writes one migration scorecard per session. Secret detection is a best-effort check, not a replacement for secret scanning and push protection.
• Works offline for common actions. A bundled catalog of verified action commit SHAs lets migrations pin common actions without network access.
• Safer migration reports. Reports document secret names and references, never values.
• APM install path. The plugin can also be installed with APM, in addition to the Copilot plugin marketplace.
• Draft-release workflow for future releases.

Not included: consolidating the plugin as the single content package (#54) is still in review.

After publishing, update the APM install pin in README.md to #v1.4.0 (#46).

What's Changed

Other Changes

• Add APM manifest as alternate install path (additive to plugin) by @AlexDeMichieli in #37
• feat: deterministic enforcement hooks for migration quality by @AlexDeMichieli in #33
• Reorder organization permissions in deployment guide by @petercort in #38
• Pin GitHub Actions to commit SHAs by @github-security-bot in #43
• Update plugin installation command in README by @petercort in #50
• fix: restore knowledge/plugin content parity and remove MCP leaks by @AlexDeMichieli in #45
• Add draft-release workflow and document the release steps by @AlexDeMichieli in #51
• Make migration reports safer, keep shared rules in sync, and avoid duplicate scorecards by @AlexDeMichieli in #52

New Contributors

• @AlexDeMichieli made their first contribution in #37
• @petercort made their first contribution in #38
• @github-security-bot made their first contribution in #43

Full Changelog: v1.3.0...v1.4.0